[Krokz]

Resolves the items left open from the #5 review after #4, plus one CI fix. Closes #5.

Issue #5 items

• 1. ACL mirroring: kept, but documented as a visibility aid only. WSL reaches NTFS as the Windows user who launched it, whatever the Linux uid, so a wsl_<uid> ACE never changes what WSL can do. acl-cleanup gains --dry-run and now tells the truth about what happened:

  • it used to print "complete" even when it couldn't list the accounts;
  • it removed them with -ErrorAction SilentlyContinue, which exits 0 on failure;
  • a missing powershell.exe produced a traceback.

  It now lists each account it removed, or would remove, and exits non-zero on any failure. The docs also showed ugow allow --mirror-acl, which argparse rejects; the flag goes before the subcommand.

• 3. Path normalization: allow, deny, check and status resolve paths with realpath. The kernel follows a symlink before the shim or an LSM hook sees the path, so a grant stored under the link itself never matched in FUSE or kmod mode. A leaf that doesn't exist yet is kept as typed, a note is printed when the resolved path differs from what was typed, and deny also removes grants stored unresolved by older versions. Tests cover .. at both the store and the CLI level.

• 4. BPF grants across remounts: ugow mount now reloads the BPF grant map after registering a drive. It exits non-zero if the reload fails, because the drive is enforced by then and its grants may be refused.

• 5. Root in BPF mode: documented how each backend treats a container running as root (the README's Docker section and the BPF docs). No code change.

• 6. End-to-end FUSE test: tests/test_fuse_mount.py mounts the real shim as root, the way the systemd unit does, and acts on it as an ordinary user. It covers reads, writes, creates, chmod by the owner, hard links, renames, ownership of created entries and the denial log, all through the kernel. It skips without Linux, /dev/fuse or passwordless sudo; CI sets UGOW_FUSE_TESTS=require so a missing prerequisite fails there instead.

• 7. Smaller items:

  • Files, directories and symlinks created through the shim now belong to the caller's real uid/gid instead of root.
  • Requirements are pinned exactly, with Dependabot (targeting dev) keeping them and the Actions versions current. The docs build dependencies move into requirements-docs.txt, with MkDocs held below 2.0.
  • The FUSE docs state that mode bits never change enforcement.

CI

• Kernel backends runs on main/dev no longer cancel each other; only superseded pull request runs are cancelled.

Testing

185 tests pass on Python 3.10–3.13, up from 149, including the 11 real-mount tests, which ran rather than skipped. The docs build with --strict.

🤖 Generated with Claude Code